ZeroHour

CVE-2026-88765

large1

Authenticated RCE via Malicious Project Import in GitLab EE Advanced Search

CVSS 3.1
8.5 high
EPSS
Published
()
Modified
AI analysis

CVE-2026-88765 is a command injection flaw (CWE-77, CVSS 3.1: 8.5 high) in GitLab Enterprise Edition that allows an authenticated user to achieve remote code execution on the GitLab server. The flaw is triggered when a specially crafted Git project export is imported and overflows the Unicode conversion buffer used during Advanced Search indexing, so it applies under certain conditions — effectively self-managed instances with Advanced Search (Elasticsearch-backed indexing) enabled. A successful attacker gains code execution with high impact to confidentiality, integrity, and availability across a changed scope, despite the modest low-privilege requirement. Affected deployments span every GitLab EE version from 12.3 up through 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes available in 19.1.8, 19.2.6, and 19.3.2. There is no known public proof of concept, and the issue is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Upgrade self-managed GitLab EE immediately to 19.1.8, 19.2.6, or 19.3.2 (or later), prioritizing instances with Advanced Search/Elasticsearch indexing enabled. As interim mitigations, restrict who can import projects (limit import permissions and disable project export/import where feasible) and consider disabling Advanced Search indexing if it is not required. Review audit logs and project import history for unexpected imports by low-privilege accounts and hunt for signs of code execution on affected hosts.

Affected
GitLab EE12.3 to 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2 (under certain conditions, e.g., Advanced Search enabled)
Estimated exposure
largeTens of thousands of internet-exposed self-managed GitLab instances, with a smaller vulnerable subset running EE with Advanced Search enabled — Public internet scan services (e.g., Shodan/Censys) have historically shown on the order of tens of thousands of exposed self-managed GitLab hosts, and the vulnerable code path further requires EE licensing with Advanced Search indexing…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

Weakness
CWE-77
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

In the news

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution

GitLab patched a CVSS 10.0 path traversal (CVE-2026-85706) plus deserialization and buffer-overflow flaws, urging self-managed users to update immediately.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing CVE-2026-85706 (CVSS 10.0), an unauthenticated path traversal in the repository commits API enabling arbitrary file reads on both Community and Enterprise Editions. CVE-2026-87719 (CVSS 9.9) is insecure deserialization in the EE GraphQL subscription serializer that can expose Advanced Search configurations and credentials, while CVE-2026-88765 (CVSS 8.5) allows authenticated RCE via crafted project exports. The update includes database migrations, so single-node deployments will experience downtime; GitLab.com is already patched.